astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-08-09 07:43:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

build(docker): ship the silo binary and translate the legacy argv command

Browse Source 
Dockerfile.goreleaser now copies silo to /usr/bin/silo, defaults to
CMD ["silo"], and labels the image as Silo. MINIO_UPDATE_MINISIGN_PUBKEY is
removed from the image environment: with the updater permanently disabled it
was dead weight, and leaving upstream's verification key in a Silo image
implied a trust relationship that does not exist. The MINIO_* runtime
environment variables, ports, volume and health endpoints are unchanged.

The image keeps shipping mcli with an /usr/bin/mc symlink. That is the client,
not a MinIO-branded alias for the server binary, and the Helm post-install job
and existing container scripts call it by name.

docker-entrypoint.sh translates a legacy first argument: `minio server /data`
becomes `silo server /data`, so an existing `command: minio server ...` in
compose or a Pod spec keeps working across the image swap. The translation is
argv-level only - no file named minio is installed, and an explicitly
overridden `entrypoint: /usr/bin/minio` still fails, which is the honest
outcome since that path genuinely no longer exists.

The entrypoint also fixes an unrelated startup hazard it was already carrying:
when the image runs under an arbitrary UID, HOME points at an unreadable /root
and the server probes its default config directory during initialization. It
now falls back to /tmp when HOME is unset, /root, missing or unwritable.

docker-entrypoint_test.sh pins all of it - empty argv, legacy minio, native
silo, bare flags, and an explicit shell command that must stay explicit. It is
wired into make rebrand-guard and into the go.yml, release.yml and
test-release.yml gates, so removing the shim breaks CI rather than breaking
users. Passing locally.

download-static-curl.sh gains checksum verification for the curl it fetches
into the build stage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
2026-08-06 08:47:59 +08:00
parent 15ab10833b
commit 30749911bd
4 changed files with 136 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dockerscripts/docker-entrypoint.sh
+29 -7
View File
@@ -1,21 +1,43 @@
#!/bin/sh
#
# If command starts with an option, prepend minio.
if [ "${1}" != "minio" ]; then
if [ -n "${1}" ]; then
set -- minio "$@"
# Run Silo by default, while translating the legacy argv-level command name.
# An explicitly supplied shell or utility remains an explicit entrypoint command.
case "${1:-}" in
"")
set -- silo
;;
minio)
shift
set -- silo "$@"
;;
silo)
;;
-*|server|fmt-gen)
set -- silo "$@"
;;
esac
ensure_writable_home() {
# The image is commonly run with an arbitrary UID or with the legacy
# MINIO_USERNAME drop-user path. Do not leave those processes pointing at
# root's inaccessible home: Silo probes its default configuration directory
# during process initialization.
if [ -z "${HOME:-}" ] || [ "${HOME}" = /root ] || [ ! -d "${HOME}" ] || [ ! -w "${HOME}" ]; then
HOME=/tmp
export HOME
fi
fi
}
docker_switch_user() {
ensure_writable_home
if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then
if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then
exec chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@"
exec chroot --userspec="${MINIO_UID}:${MINIO_GID}" / "$@"
else
echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd
echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group
exec chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@"
exec chroot --userspec="${MINIO_USERNAME}:${MINIO_GROUPNAME}" / "$@"
fi
else
exec "$@"